A customer has multiple Aruba Controllers integrated with ClearPass for guest access using a controller-initialed login method. The customer is aware that a public CA-signed captive portal certificate is required in Aruba controllers for controller-initiated workflows. The customer has purchased unique public CA-signed server certificates for each controller.
What configuration steps would you suggest to the customer to complete the deployment? (Select three.)

• A.Add all the controller IP address and its certificate common names in the DNS server's Forward Lookup Zones and Reverse Lookup Zones to resolve queries from client.
• B.From the Aruba controller, enable the option "Add switch IP address in the redirection URL" under the respective L3 Authentication profile mapped in the initial role
• C.Edit the HTML header in the weblogin/ self-registration register page with a script to match the controllers IP and captive portal certificate CN names respectively.
• D.From the weblogin/ self-registration page Login form settings, enable the check box for "The controller will send the IP to submit credentials" under Dynamic address.
• E.From the weblogin/ self-registration page NAS Vendor settings, enable the check box for "The controller will send the IP to submit credentials" under Dynamic address.
• F.From the Aruba controller, enable the option 'Add switch ip address in the redirection URL' under the respective guest AAA profile mapped in the VAP profile.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.


You have integrated the Cisco switch with ClearPass to do MAC-Auth for Cisco IP Phones. The phones connect to the network successfully but when you try to change the status of the device from the access tracker, you see only the ArubaOS Radius terminate session options and not the Cisco vendor terminate session options. What will you check to fix this issue?

• A.Verify if the Enable RADIUS Dynamic Authorization option is checked for the Cisco switch added under the network devices.
• B.Verify that Cisco is chosen as the vendor name while adding the Cisco Switch under network devices.
• C.Verify if the ClearPass supports RADIUS Dynamic Authorization for the Cisco IP Phones doing MAC.AUTH.
• D.Verify if the Cisco IP Phone is actively connected to the switch to get the Cisco CoA options from ClearPass.

Comment: *

Name: *

Email: *

Verification: *

A corporate Clear Pass Cluster with two servers located at a single site, has both Management and Data port IP addresses configured. The Management port IPs art in the DataCenter networks subnet, while the Data port IPs are in the DMZ. What is the difference between using one Virtual IP for the AAA traffic versus sending AAA requests to the physical IPs for each server' (Select two.)

• A.Using the one Virtual IP can provide failover.
• B.By using the Virtual IP, the failover wait time is faster than using individual server IPs.
• C.The failover can be accomplished only by using Virtual IP
• D.One Virtual IP can be used together with the individual server IPs for load balancing.
• E.The Individual IPs can provide failover and load balancing.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

A customer has configured Onboard in his lab ClearPass server and Windows devices work as expected but cannot get the Apple iOS devices to Onboard successfully Where would you look to troubleshoot the issue? {Select two)

• A.Check if the customer has installed the same internal PKI signed RADIUS server certificate as the HTTPS server certificate.
• B.Check if the customer has installed a custom HTTPS certificate for iOS and another internal PKI HTTPS certificate for other devices.
• C.Check if the ClearPass HTTPS server certificate installed in the server is issued by a trusted commercial certificate authority.
• D.Check if the customer installed the internal PKI Root certificate presented by the ClearPass during the provisioning process.
• E.Check if a DNS entry is available for the ClearPass hostname in the certificate, resolvable from the DNS server assigned to the client.

Comment: *

Name: *

Email: *

Verification: *

Under OnBoard Management and Control, which option will deny the user from re-enrolling one of his devices with Onboard?
View by Certificate >> Click on the device >> Delete certificate

• A.Click on the device >> Revoke certificate >> Revoke this client certificate
• B.View by Username >> Click on the user >> Delete Actions >> Delete all devices
• C.Delete this client certificate View by Dev >> Click on the device
• D.Manage Access >> Deny access to this device View by Certificate

Comment: *

Name: *

Email: *

Verification: *